Privacy Policy

1. Overview and scope

This Privacy Policy describes how Metatech ID (PT Trifidia Cipta Korpora), a limited liability company incorporated under the laws of the Republic of Indonesia, with its registered address at Graha Mampang Lantai 3, Suite 305, Jl. Mampang Prapatan Raya Kav-100, Jakarta Selatan, DKI Jakarta 12790 ( "SambungAPI", "we", "us", or "our"), collects, uses, discloses, stores, and protects information when you visit our website or use our service, SambungAPI (the "Service"), a hosted platform through which your organization's members and bots talk with people on messaging channels, and which connects your organization's third-party tools and calls them through one API.

This Policy applies to visitors of our website, to the organizations, projects, and principals (people and API keys) that use the Service, and, as Section 12 describes, to the people with whom an Organization talks on a channel. This Policy does not apply to third-party websites, products, or services, even if they are linked to from the Service, and you should review the privacy practices of those third parties separately.

By creating an organization, signing in, or otherwise using the Service, you acknowledge that you have read and understood this Policy and agree to the collection, use, disclosure, storage, and processing of your information as described in this Policy. If you do not agree with any part of this Policy, you must not use the Service.

2. Definitions

• "Personal information" means information that identifies, or could reasonably be used to identify, you as an individual, and organizational information that you provide to us in connection with your use of the Service.
• "Organization" means an organization in the Service, which holds projects, members, and settings. An Organization can represent a company, a team, or one person.
• "Channel" means a messaging platform through which an Organization talks with people, such as the WhatsApp Business Platform.
• "Connected account" means a third-party account (such as a Google account) that you authorize the Service to access on your behalf.
• "Tool call" means a request made through the Service to a third-party provider using a connected account.

3. Information we collect

We collect only the information necessary to operate the Service:

• Account information. You create an account by signing in with Google, or with an email address and a password. Our identity provider, Firebase Authentication (a Google service), confirms who you are and sends us your name, your email address, whether that address has been verified, an identifier for your account, and the sign-in method that you used. If you sign up with an email address and a password, we use your email address as your name until you change it. Your password is held only by our identity provider: our servers never receive or store it. When you sign in with Google, Google shares your name, email address, and profile picture with our identity provider, which keeps them with your sign-in. We do not use your profile picture. Signing in with Google gives the Service access to nothing else in your Google account: a project reaches a Google service only through a connected account that you authorize separately. Our identity provider also processes the IP address and browser information of each sign-up and sign-in to protect your account and to prevent abuse, and it keeps those IP addresses for a few weeks. For a sign-up or a sign-in with an email address and a password, our identity provider can use Google reCAPTCHA, which reads information about your browser and device, to find requests that a script makes. When you first sign in, we create an Organization for you and give it a default name that contains your name, such as "Jane Doe's organization". Its members and the people they invite see that name. You can change your name, and an Organization owner can rename the Organization.
• Invitations and members. When a member of an Organization invites a person, we store the email address that the member enters, and we may send the invitation to that address by email. The members of an Organization can see the name of each of its members, and members whose role allows it can see the email address of each invitation.
• Project information. The projects, API keys (stored as hashes, never in plaintext), and settings that you create within your Organization.
• Connected-account credentials. When you connect a third-party account to the Service, we store the access tokens necessary to call that provider on your behalf. These credentials are encrypted — see Section 6 (Security of your information).
• Activity records. A record of each tool call made by your project, including the tool called, the time, and whether it succeeded. The response that the provider returns to a tool call that changes data is stored for a limited period, as described in Section 7 (Data retention). The response to a tool call that only reads data is not stored, and the arguments of a tool call are not stored. For a tool call made through our MCP endpoint, a one-way fingerprint of its arguments, not the arguments themselves, is stored for a short period, as described in Section 7, so that a repeated call can be recognized.
• Stored files. A file that your project uploads to the Service so that a tool call can use it, with its name, type, size, and checksum, and the tool that it was uploaded for.
• Usage data. Aggregated counts of tool calls per project and per organization, used to enforce usage limits and to provide usage summaries.
• Messages on channels. The messages, contacts, conversations, and consent records of the people with whom your Organization talks on a channel, as described in Section 12 (Messages on channels).
• Security records. A record of security-relevant actions in the Service, such as each sign-in, each API key that is created, each change to who can access an Organization, and each third-party account that is connected, with the time, the account or the key that acted, and whether the action succeeded. These records do not include your password, your tokens, or your IP address.

We do not currently collect payment or billing information: the Service has no paid tier. If a paid tier is introduced, we will update this Policy before any billing information is collected.

4. How we use your information

We use the information described in Section 3 solely for the following purposes:

• To establish, maintain, and secure your account and session.
• To route tool calls initiated by you or your project to the connected account you chose, and to return the results.
• To carry, show, and keep the messages of your Organization's channels, as described in Section 12.
• To enforce usage limits and to provide usage summaries.
• To operate our backup, retention, and deletion mechanisms, as described in Sections 6 and 7.
• To investigate and respond to security incidents, abuse reports, and support requests.
• To comply with applicable legal obligations.

We do not use your personal information for advertising, we do not sell or rent your personal information to any third party, and we do not share it with third parties for their own marketing purposes. Any disclosure of your information is made solely as described in Section 5.

5. Disclosure of your information

The purpose of the Service is to call third-party providers on your behalf using the connected accounts you authorize. Accordingly, we disclose only the minimum information necessary for the specific tool call that your project requested, and never for any purpose you did not initiate.

Limited Use disclosure. SambungAPI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not keep the information that a tool call reads from a Google API. When a tool call changes data through a Google API, we keep the response for 24 hours, to answer a repeated request, and then delete it.

Providers that may be referenced in our marketing or documentation but that have no OAuth application registered — including GitHub, Notion, Linear, and Jira — are not offered through the Service. If your organization nevertheless stores a token of its own for such a provider through the API, the Service sends that provider the token and the arguments of each tool call that your project makes with it. That provider's own terms and privacy policy govern what it receives.

We also rely on third-party providers that host and operate the Service itself, including infrastructure providers, our identity provider (Firebase Authentication, a Google service, described in Section 3), and the encrypted backup destination described in Sections 6 and 7. We disclose your information to these providers solely to operate the Service, and we require them to maintain appropriate confidentiality and security obligations. Apart from our identity provider, we do not publish a named list of these providers on this page; if you require it for a vendor risk review, contact us (see Section 14).

We may also disclose your information (i) as required by applicable law, regulation, or legal process; (ii) to enforce our Terms of Service; or (iii) to protect our rights, privacy, safety, or property, or those of our affiliates, you, or others.

Where you provide us with personal information relating to other individuals, you represent and warrant that you have obtained the consent of such individuals for the collection, use, disclosure, and processing of their information by us in accordance with this Policy.

6. Security of your information

• Encryption. Connected-account credentials are encrypted (AES-256-GCM) before they are stored.
• Encrypted backups. We make daily encrypted backups of the Service. Backups are encrypted before they leave our infrastructure, and the keys capable of decrypting them are held separately from the Service.
• Isolation. Your information is logically isolated from the information of other organizations using the Service.
• Logging. We do not write credentials, API keys, or the contents of tool calls into our operational logs.

No method of storage or transmission is perfectly secure, and we make no representation of specific security certifications — see our Terms of Service for an honest description of the Service's maturity. To report a security issue, contact us (see Section 14).

7. Data retention

We retain your information only for as long as necessary to provide the Service and to fulfill the purposes described in this Policy:

• Records of tool calls are retained for 30 days, after which they are deleted.
• Our security audit records are retained for 365 days, after which they are deleted.
• The response that a provider returns to a tool call that changes data, such as sending an email or creating an event, is retained for 24 hours, only so that a repeated request that carries the same idempotency key, or the same call repeated through our MCP endpoint within 60 seconds, can be answered with the same result, and is then deleted. If your project opts in to a longer period, such a response is retained for no longer than 30 days, except a response from Google, which is deleted after 24 hours in every case. The response to a tool call that only reads data is not retained. The arguments of a tool call are not retained. For a call made through our MCP endpoint, a one-way fingerprint of its arguments is retained for no longer than 24 hours, and is then deleted.
• The content of a file that your project uploads can be downloaded for up to one hour after the upload, and is then deleted. The file's name, type, size, and checksum, and the tool that it was uploaded for, are retained for 30 days, after which they are deleted.
• Your session expires after 7 days of inactivity, and in all cases no later than 30 days after you sign in.
• When you ask us to delete your account, we sign you out everywhere, revoke your personal API tokens, and pause every Organization in which you are the only member: its API keys stop working, and its data stays as it is. After 30 days, we delete your sign-in with our identity provider, your name, your email address, the names of your personal API tokens, and every connected account filed under your account in an Organization you belong to or belonged to, and we delete every Organization in which you are the only member, as described in the next item. Each other Organization that still has the default name that we gave it when you signed in gets the name "Former member's organization". A name that a person chose does not change, even when it contains your name. If you sign in during those 30 days, the deletion is canceled. Our security audit records keep an internal identifier of your account, and each name that a rename or a delete replaced: of your account, of an Organization, or of a project. Such a name can contain your name or email address. When we delete your account, we delete from these records the earlier names of your account and the default names that we gave your Organizations, except in records made before October 9, 2026. Only our operators can read these records.
• When an Organization is deleted, we revoke its sessions and API keys, delete its project data and stored files, and retain a minimal, non-sensitive record of the deletion for 30 days. Our security audit records of the Organization are not deleted with it: each one is deleted at the end of its retention period, as described above.
• When an owner of an Organization asks us to delete it, its API keys stop working, and its data stays as it is for 30 days. An owner can cancel the deletion during that time. After 30 days, we delete the Organization as described in the previous item.
• When a project is deleted, no API key can reach it any more, and we revoke each API key that reaches nothing else. We immediately delete the project's connected-account credentials, stored files, and records of tool calls. The project's aggregated usage counts remain part of your Organization's usage data. Its connected accounts are deleted as the next item describes.
• When a connected account is deleted, on its own, with its project or Organization, or because the person it is filed under deleted their account, left the Organization, or was removed from it, we delete its credentials. If it was connected through our Google application, we also ask Google to revoke our access, unless another connected account may still use that access. Access that you granted through your own OAuth application, or in another provider, stays until you remove it in that provider's account settings. When a WhatsApp Business Account that you connected through Meta's Embedded Signup is deleted, we ask Meta to stop sending us its messages. Its phone numbers stay registered with Meta, and our app keeps its access to the account until you remove the app in Meta Business Suite.
• When a channel's platform asks us to stop your organization's use of that channel, we keep the data of that channel until the stop ends, until your organization deletes it, or until the platform tells us that the stop is final or asks us to delete it.
• When a WhatsApp Business Account is deleted, we delete its messages, conversations, and consent records. Its contacts stay with the Organization until the Organization deletes them or is deleted. Section 12 describes how long we keep the other information of a channel.
• When a member of an Organization whose role allows it deletes a contact, we delete the contact, the identifiers of that person on each channel, such as a phone number, the messages to and from that person with their statuses, the conversations of that person, and the consent records of that person. The Organization's usage counts stay. The copies of events that Meta sent us, the copies of messages that we sent to the Organization's systems, and our security audit records that can name that person are deleted at the end of their own periods, as Section 12 describes. A later message from that person starts a new contact.
• Backups are retained in accordance with the backup provider's retention policy and are always encrypted. Data that you delete can remain in a backup until that backup expires.

8. Your rights

Subject to applicable law, you may have the right to request access to, a copy of, correction of, or deletion of your personal information, and to object to or restrict certain processing of your personal information. To exercise any of these rights, contact us at the address in Section 14. We will respond to your request in accordance with applicable law.

If you talked with an Organization on a channel and do not use the Service yourself, Section 12 describes the information that we keep for that Organization, and where to send a request about it.

You can delete your account yourself. In the console, open the account menu at the top of the page (your name or initials), select Delete your account, and sign in again to confirm. Your account is deleted 30 days later, and signing in before then cancels the deletion. The deletion removes every Organization in which you are the only member, with all of its data. For each Organization where you are the only owner and other people are members, you choose one of them, who becomes its owner at once, and the Organization and its data stay with its members. You leave every other Organization, and its data stays with its members. In each Organization that stays, we delete the connected accounts filed under your account.

If you are an owner of an Organization, you can delete the Organization yourself. In the console, open Settings in the Organization section of the navigation, select Delete organization, and sign in again to confirm. The Organization is deleted 30 days later, and until then an owner can cancel the deletion.

If you are an owner or an administrator of an Organization, you can download a copy of its data yourself. In the console, open Settings in the Organization section of the navigation, and select Download export. The copy is one JSON file with the Organization's projects, the names of its API keys, its connected accounts, its records of tool calls from the last 30 days, the list of its stored files, its usage counts, its members and invitations, its teams, its WhatsApp Business Accounts and message templates, its Facebook Pages and Instagram accounts, its proactive messages and consent records, its contacts, and its conversations with their messages. It never includes connected-account credentials, API keys, signing secrets, or the content of stored files. While a channel's platform has asked us to stop your organization's use of that channel, the copy leaves out the data of that channel; we keep that data, as our Terms of Service describe.

You can also ask us to delete your account or an Organization's data, or to export an Organization's data, by contacting us at the address in Section 14. Exports include your project metadata, activity records, and the list of your stored files, but never the content of a stored file, your connected-account credentials or API keys, which cannot be exported by design. Deletion follows the mechanics described in Section 7.

We describe our practices honestly and do not claim certification or formal compliance under any specific data-protection law, including the GDPR, the CCPA, or Indonesia's Law No. 27 of 2022 on Personal Data Protection (UU PDP). If your Organization requires a specific contractual commitment under one of those frameworks, contact us.

9. Cookies

The Service sets two kinds of first-party cookies, both strictly necessary for the Service to function:

• A session cookie that keeps you signed in. It is readable only by the server and never by scripts on the page.
• A temporary cookie used while you connect a third-party account, which expires within 10 minutes.

We do not use analytics cookies, advertising cookies, or third-party tracking cookies, and we do not engage in cross-site tracking. Because every cookie we set is strictly necessary for the Service to function, we do not display a cookie-consent banner.

10. Children's privacy

The Service is a developer and business platform and is not directed at children. We do not knowingly collect personal information from children. If you believe that a child has provided us with personal information, contact us (see Section 14) and we will delete it.

11. International data transfers

The current production deployment of the Service (sabi.metatech.id) is hosted in Jakarta, Indonesia. Our identity provider, Firebase Authentication, processes the information that it holds for your sign-in, including your email address, your password, and the IP address of each sign-in, in the United States. Other deployments of the Service may be hosted in other jurisdictions, and this Policy does not guarantee the jurisdiction in which a given deployment stores data. Backup archives are stored at an encrypted destination separate from the Service's infrastructure; the jurisdiction of that destination is deployment-specific. Where your information is transferred to a jurisdiction other than your own, we will take measures to ensure that the transfer complies with applicable data-protection law and that your information remains protected to the standards described in this Policy. In certain circumstances, courts, law enforcement agencies, or regulatory authorities in those jurisdictions may be entitled to access your information.

12. Messages on channels

An Organization can connect a channel to the Service. A channel is a messaging platform through which the members of an Organization, and its bots through our API, talk with people. Today the Service has three channels: the WhatsApp Business Platform, Messenger and Instagram. Most of these people do not use the Service themselves: they are the customers and other contacts of the Organization. This section tells them, and the Organization, what we keep about them.

The Organization decides why it talks with these people and what it keeps about them, and its own privacy notice applies to them. We process their information only on behalf of the Organization and at its direction, to provide the Service to it. We do not use it for our own purposes or for advertising, and we do not sell it.

For each channel, we keep:

• Messages. The messages that a person sends to a business phone number of the Organization, and the messages that the Organization sends to that person, with their time, their type, and the statuses that Meta reports for them, such as delivered and read. For a file in a message, such as a photo or a document, we keep only the identifier that Meta gives it. We get the file from Meta each time the Organization opens it, and we do not store it.
• Copies of messages with another app. When an Organization uses a business phone number with another app too, the copies of the messages between a person and that app on the number. Meta sends us these copies only when the Organization grants that app's standby visibility to the Service.
• Conversation summaries. The summaries of a conversation that Meta generates and sends to us, with the time that each one arrived.
• Contacts. The phone number of each person, the name that the person shows on WhatsApp, and, for a number that the Organization also uses in the WhatsApp Business app, the name that the Organization saved for that person in the app. The members of the Organization can add a name, labels, and a note.
• Conversations. Which member or team of the Organization answers each conversation, its state, and which messages the members read.
• Consent records. Whether a person agreed to receive marketing, utility, or authentication messages from the Organization, how and when the person agreed, and each withdrawal, including a stop of marketing messages that Meta reports for the person.
• Past chats. For a number that the Organization also uses in the WhatsApp Business app, the individual chats of the last 180 days in that app, when the app shares them at the connection.
• Messenger and Instagram. The messages that people send to a Facebook Page or an Instagram professional account of the Organization, and the messages that the Organization sends to them, with their time, their type, and the delivery and read statuses that Meta reports for them. For a file in such a message, we keep only its type. For each person, the identifier that Meta gives the person for that Page or Instagram account, and the name that Meta returns for the person, with the person's Instagram username on Instagram. For each Page or Instagram account, its identifier, its name or Instagram username, and each access token that Meta issued for it, encrypted. When a person deletes a message on Instagram, we delete its content and keep only the time of the deletion. A member of the Organization whose role allows it can delete a message or a conversation of Messenger or Instagram in the Service. We then delete it from the Service, and the person still sees it in Messenger or Instagram.

We disclose this information only:

• To Meta, which carries each message between the Organization and the person. WhatsApp's own terms and privacy policy apply to what Meta does with it.
• To Meta, which carries each Messenger and Instagram message between the Organization and the person. Meta's own terms and privacy policy apply to what Meta does with it.
• To the members of the Organization in the Service, and to the systems that the Organization registers to receive its messages from the Service.
• To Meta, when Meta asks for it: the list of the Organizations that use the WhatsApp Business Platform through the Service, with the name and the email address of each of their owners.
• For the legal reasons in Section 5.

How long we keep it:

• We keep messages, contacts, conversations, and consent records until the Organization deletes them. A member of the Organization whose role allows it can delete a contact, with the messages, conversations, and consent records of that person. Our security audit records of requests made before October 16, 2026 can contain the phone number or the WhatsApp user ID of that person. Each one is deleted at the end of its retention period, as Section 7 describes. Deleting the WhatsApp Business Account through which they came deletes its messages, conversations, and consent records, and deleting the Organization deletes all of them. The Service sets no time limit on them, because the Organization decides how long it needs them. Section 7 describes these deletions.
• On Messenger and Instagram, we keep the messages, conversations, and contacts of a Facebook Page or an Instagram professional account until the Organization is deleted. The Service does not yet let the Organization delete a Page or an Instagram account. When Meta refuses the access token of a Page or an Instagram account, for example because its admin removed our app, we mark the Page or the account as disconnected and refuse to send through it. We keep its messages, conversations, and contacts, and its access token, encrypted, with no time limit. When the Organization connects the Page or the account again, it is connected again, with all of them.
• Meta sends each message and each status to us as an event. We keep the content of an event for 7 days after we process it, and a record of its receipt, without its content, for 30 days, so that we can recognize a copy that Meta sends again. We keep the events that carry past chats and app contacts for 30 days after we receive them, and the past chats until 30 days after their transfer ends.
• When we send a message to a system of the Organization, we keep that copy until 30 days after we deliver it or stop trying.
• Backups follow Section 7.

We do not write the content of messages into our operational logs.

If you talked with an Organization on a channel, the Organization decides what it keeps about you. Ask the Organization to show, correct, or delete it. The Organization can delete what it keeps about you in the Service. The copies of events described above go at the end of their own periods. If you write to us about such information at the address in Section 14, or Meta passes your request to us, we send the request promptly to the owners of that Organization. We do not decide the request for the Organization.

A Page admin can remove our app in Facebook's settings: open Settings and privacy, then Settings, and under Your activity select Business integrations. An Instagram user can remove our app in Instagram's settings, under Website permissions, then Apps and websites, and can turn off Allow access to messages under Messages and story replies, then Message controls, then Connected tools. Each of these withdraws access that the Page or the account granted to our app. We keep what we already hold, as described above.

13. Changes to this policy

We may update this Policy from time to time. The "Effective Date" at the top of this page indicates when this Policy was last revised, and any changes are effective when we post the revised Policy on this page. Your continued use of the Service after the posting of a revised Policy constitutes your acceptance of the revised Policy. It is your responsibility to periodically review this Policy.

14. Contact us

If you have questions or concerns regarding this Policy, or if you wish to exercise any of your rights under Section 8, please contact us at privacy@metatech.id or info@metatech.id. For legal correspondence, contact us at legal@metatech.id. Please include enough context for us to assist you, such as the relevant endpoint or project, and the time of the relevant activity. Please do not send passwords, API keys, or access tokens by email.